pc[.]kcmtraincxx[.]cc

Analysis of pc.kcmtraincxx.cc indicates that the domain was registered on 21 February 2026 and is presently taken offline. DNS resolution points to 104.21.12.162, an address owned by Cloudflare, Inc. (AS13335) located in the United States. The site presented the page title “KCM Trade Limited,” which suggests an attempt to impersonate a corporate entity, though no further branding information is available. The SSL certificate is identified as “WE1,” confirming that TLS was in place at the time of capture. Reputation data shows that the domain is listed on a single security blocklist and has been actively blocked by PhishDestroy.

VirusTotal scans returned three positive detections out of ninety‑three submitted engines, providing independent confirmation of malicious intent. No additional public blocklists or Safe Browsing entries were reported in the supplied intelligence. The limited evidence set prevents a full characterization of the phishing payload or the specific credential‑stealing techniques employed. However, the combination of a recent registration, Cloudflare hosting, a corporate‑sounding title, and multiple vendor detections aligns with typical infrastructure used for generic credential‑harvesting campaigns.

Defenders should add pc.kcmtraincxx.cc to their deny‑list and monitor traffic to the associated IP address for any residual connections. Network sensors should be configured to block outbound requests to the domain and to the Cloudflare IP range 104.21.12.0/24. Endpoint protection solutions that incorporate the three VirusTotal detections can be used to flag any attempted downloads or scripts originating from this host. Continuous observation of the IP reputation is advised in case the address is reused for future campaigns.